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Iv LNTRODUCTION 


A. PURPOSE 

The Federal Managers' Financial Integrity Act of 1982 
(FMFIA) requires department and agency managers to identify 
internal control and accounting system weaknesses that can 
lead to fraud, waste and abuse in government operations. The 
issue of implementing an effective internal control program 
in the Navy is very important. With increasing public 
scrutiny over the misuse of government assets, Navy managers 
will meed to become more concerned with obtaining and 
BeEllizing resources effectively and efficiently in 
accomplishing their objectives. One means to achieving these 
objectives is an effective internal control program. The 
FMFIA provides an important impetus to restoring public 
confidence in the management of the government. “In its 
Current implementation of the Act, the Navy has made a 
concerted effort to comply with the Act's spirit and letter, 
and has made some progress in greater organizational 
coverage and more effective internal control evaluations. 
Implementation of an effective internal control program in 
the Navy to meet the objectives of the FMFIA has not been 
smooth sailing for the Navy and other federal agencies as 
they have encountered numerous implementation problems. The 


purpose of this thesis is to review and evaluate the Navy's 


Progress in implementing the FMFIA including discuss tones 


past implementation problems and to identify areas _ for 
improvement that managers can use to help them with the 


internal control process. 


Be BACKGROUND 

The Budget and Accounting Act of 1950 required the head 
of each department and agency to establish and maintain 
adequate systems of internal control. 

With growing concern over numerous publicized cases of 
government mismanagement of resources, Congress amended the 
Budget and Accounting Act via the FMFIA to require ongoing 
evaluations and reports on the adequacy of the system of 
internal controls. The Act further requires federal managers 
to correct the weaknesses and report annually to the 
President and the Congress on their programs. The FMFIA also 
required the Office of Management and Budget (OMB) to 
consult with the Comptroller General of the United States to 
establish guidelines for these evaluations and reports 
OMB revised the already established government policy on 
internal control and assigned management the responsibility 
of establishing, maintaining, reviewing and improving 
internal control systems in each agency. 

Unfortunately, the Navy has experienced implementation 
difficulties with the FMFIA. Some of the implementation 


problems encountered by the Navy include initial lack of 
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guidance from the headquarters level, no training for line 
managers on how to perform required reviews, significant 
resistance from line managers to complete required reviews 
and the significant amount of time and paperwork burden 
associated with the entire management’ control review 


process. 


C. SCOPE AND METHODOLOGY 

The objective of this thesis is to examine and evaluate 
the Department of the Navy's progress in implementing’ the 
Act. The history and evolution of internal control in the 
Federal Government and an overview of the current internal 
control evaluation system will be reviewed. 

This thesis then presents the research effort by first 
presenting a history of the Navy's internal control program, 
a review of the Navy's financial management structure and 
accounting systems weaknesses. Then the problems experienced 
by the Navy in implementing an effective internal control 
program are discussed. This is followed by examining the 
solutions to the implementation problems as well as_ the 
shortcomings of these solutions. 

Finally, the conclusion is reached that there are ways 
to improve the process, such as improving direction = and 
e0o0rdination in the Act's implementation, emphasizing 
alternatives to internal control reviews, focusing efforts 
on high risk areas, improving management training and using 
a checklist approach to completing the required reviews. 


dre 


The research consisted of telephone interviews to 
solicit any innovative ideas to improve implementation of 
the Act. In addition, a detailed search and evaluation was 
made of the literature in the area of internal control 
systems and the GAO audits of the Navy's’ progress in 


implementation of the Act. 


D. ORGANIZATION OF THESIS CHAPTERS 

Chapter II provides a discussion on the background of 
the Federal Government's internal control system. This 
includes a discussion of the Budget and Accounting Act of 
1950, OMB Circular A-123, the FMFIA, and the GAO standards 
for internal controls in the Federal Government. 

Chapter III examines the internal control evaluation 
system. This chapter covers the DOD internal control 
evaluation process, ine lud ing==pertornigag vulnerability 
assessments and management control reviews. 

Chapter IV details the history of the Navy's’) Internal 
Control Program, the Navy's financial management structure 
and accounting systems weaknesses, and covers the 
implementation problems the Navy has experienced in 
implementing their internal control program. 

Chapter V details the Navy's implementation problems 
solutions and the shortcomings of those solutions. 

Chapter VI provides a summary along with some 
conclusions about and recommendations Pow further 
implementation of the FMFIA. 
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II. INTERNAL CONTROL IN THE FEDERAL GOVERNMENT 


A. BUDGET AND ACCOUNTING ACT OF 1950 

The Budget and Accounting Act was passed in 1950 and 
required that each agency head establish and maintain 
systems of accounting and internal control. The passage of 
the produced high expectations that these systems of 
accounting and internal control would help reduce or prevent 
fraud, waste, abuse and mismanagement in Federal Government 
operations. Unfortunately, development of effective systems 
has been slow and numerous situations continue to appear in 
the news headlines which show lack of fiscal responsibility, 
such as instances of fraud, waste and abuse continue to 


occur at unacceptable levels. 


B. OFFICE OF MANAGEMENT AND BUDGET CIRCULAR A-123 

One reason given for the ineffectiveness of the Budget 
and Accounting Act was its lack of enforcement. Although 
the Act was understood as the current standards of internal 
Standards of internal control, it did not provide specific 
guidance on internal control systems or require mandatory 
reports on the quality of those systems. 

To give the Act more teeth, OMB issued Circular A-123 
in October 1981 as an early effort to improve controls. The 
Circular required the head of each department and agency to 


develop and maintain adequate systems of internal control. 


les 


Unlike the 1950 Act, however, it defined requirements and 
responsibilities in order to transform the 91950 Ace 
expectations and enforcement into reality. 

The purpose of A-123 is to prescribe policies and 
procedures to be followed by executive departments) and 
agencies in establishing, maintaining, evaluating, 
improving, and reporting on internal controls in )eheme 
program and administrative activities (ref. 1l:p.1). 

Congress also saw the need for effective internal 
management in the Federal Government. The pressure for 
Congress to act to force improvement in the government 
agencies' internal management was fueled by the numerous 
headlines of fraud, waste and abuse in federal activities 
and programs, eroding public confidence,and the government's 
inability to operate effectively. Continuing concern over 
the poor condition of government internal control Same 
accounting systems led the Congress to pass the Federal 


Managers' Financial Integrity Act of 1982502 73-2.) 


C. FEDERAL MANAGERS' FINANCIAL INTEGRITY ACT OF 1982 
This Act requires that agency heads annually report to 
the President and the Congress as to whether their internal 
accounting and administrative control systems comply with 
the Comptroller General's internal control standards and 
provide reasonable assurance that: 
- obligations and costs are in compliance with applicable 


law; 
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- funds, property and other assets are safeguarded;and 


—- revenues and expenditures are properly recorded and 
aqeemutced Lor (ref. 2:p.2). 


The Act requires that each agency evaluate its internal 
control system in accordance with guidelines prescribed by 
OMB and report annually any material internal control 
weaknesses together with plans for correction. The annual 
report must also indicate whether or not the agency's 
accounting system conforms to the Comptroller General's 
accounting requirements. 

The Act directed that the evaluation and em OM ing 
requirements be implemented in two steps. The first step 
was the preparation of guidelines for the evaluation of 
internal and administrative controls by OMB in consultation 
with the Comptroller General by December 31,1982. The second 
step required commencement of annual reporting by the 


agencies by December 31, 1983. 


D. STANDARDS FOR INTERNAL CONTROLS IN THE FEDERAL GOVERMENT 

To satisfy the first step, it was necessary to define 
what was meant by internal control. The American Institute 
of Certified Public Accountants (AICPA) has-_ made a 
aistinction between internal accounting ECONEEORsS and 
administrative GOnerols: Administrative controls are 
concerned with the decision processes leading to 
management's authorization of transactions. This 


authorization is the starting point for establishing 


iB 


internal accounting control of “~transaecueuse Internal 
accounting controls are concerned with safeguarding “os 
assets and reliability of Financial records. Given 
the AICPA definitions of administrative and internal 
aCCOUntinag ‘Conerc.s the Federal Government needed to 
develop standards for internal controls. OMB requested GAO 
to develop these standards. GAO reponded by publishing 
STANDARDS FOR INTERNAL CONTROLS IN THE FEDERAL GOVERNMENT in 
1983. This document, which has come to be Known as the 
"green book" was derived from the professional standards 
established by the AICPA and includes the following concept 
of internal controls which is useful in understanding and 
applying the internal control standards: "The plan of 
organization and methods and procedures adopted by 
management to ensure that resource use is consistent with 
laws, regulations and policies; Chat resources are 
Safeguarded against waste, loss, and misuse; and that 
reliable data are obtained, maintained, and fairly disclosed 
Ins reports. weta ps tp. 

What is an internal control standard? GAO defines it as: 
"the minimum level of quality acceptable for internal 
control systems in operation and constitute the criteria 
against which systems are to be evaluated." (ref.3:p.2) The 
definition adds that these standards apply to all functional 
areas, not the financial or accounting areas. Each area 


has some inherent internal controls in the form of 
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Pais Gructions mission and performance requirements and 
program objectives. 

The "green book" breaks the standards for internal 
control into three areas: general standards, specific 
standards, and the audit resolution standard. 

ibis General Standards of Internal Control 

GAO lists five general standards of internal 
control which apply to all aspects of internal controls. 
a. Reasonable Assurance 
mnterna l Genmtrol systems are to provide 
reasonable assurance that the objectives of the systems will 
be accomplished."(ref.3:p.4) The term "reasonable assurance" 
is inherently subjective, difficult to define and requires 
judgment to be exercised. The concept of reasonable 
assurance recognizes that internal controls must be cost- 
BemerilCial. That is, the cost of internal control should not 
exceed the benefit derived. A cost here refers to the 
financial measure of resources consumed in accomplishing a 
Specified purpose. The benefit derived from a control refers 
to the reduction in risk from failing to achieve the 
Sajective of the control. Because the benefit is often not 
precisely quantifiable, it is more difficult to define and 
Getermine, and decisions must depend on estimates. and 
judgments by management. To increase the amount of control 
in an area usually will result in an increase in cost. 


Therefore, the judgment required to be performed with each 


iv] 


control is whether the cost of the control exceeds the 
benefits derived. 
Db. Suppermeive Attitude 

"Managers and employees are to maintain and 
demonstrate a positive and supportive attitude toward 
internal controls at all times." (ref.3:p.4) Line management 
commitment to achieving effective internal controls is vital 
to the success of achieving the intent of this standards 
This standard requires agency managers and employees to be 
attentive to internal control matters and to take stene to 
promote the effectiveness of the controls. The bottom line 
here is that overall leadership is critical to maintaining a 
positive and supportive attitude toward internal controls. 
This is accomplished through training, motivating employees 
and encouraging management improvement suggestions. 

Cc. Competent Personnel 

"Managers and employees are to have personal 
and professional integrity and are to maintain a level of 
competence that allows them to accomplish their assigned 
duties, as well as understand the importance of developing 
and implementing good internal controls." (ref. 3 )pames 
Managers and their staffs are required to maintain and 
demonstrate their personal and professional integrity, a 
skill level necessary to ensure effective performance and a 
sufficient understanding of internal controls to effectively 


discharge their responsibilities. Professional integrity 
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Can be promoted or strengthened through an operative code of 
Sencuciee iumadditwen, wotaffting decisions™ should™ include 
verification of minimum education and skill requirements. 
ar the Federal Government Chis is a severe 
limitation. Therefore, training programs are required. 
Performance appraisals should also include an assessment of 
the manager's implementation and maintenance of effective 
internal ceomerols. Managers who possess a good 
understanding of internal controls are vital to effective 
control systems, and these managers should be used in 
formal and on-the-job training programs. 
d. Control Objectives 

"Internal Gontrol objectives are to be 
identified or developed for each agency activity and 
are to be logical, applicable, and reasonably complete." 
feo >-6) The purpose o£ this standard is that the 
control objectives are tailored to the agency for each 
of its operations. Usually, all operations of an agency 
are grouped into cycles that are compatible with the 
agency's division of responsibilities. Some agencies collect 
cash, others do not; some pay out cash; some are more 
administrative in nature; and some are more program and less 
Financially oriented. Examples of cycles include financial, 
administrative, agency management and program (operational) 
cycles. These cycles interact and controls’ over their 


interaction must be established.To comply with this 


JE 


standard,an agency must identify and analyze each cycle to 
determine the internal control objectives. These objectives 
can then be used to evaluate the agency's internal controls. 
e. Control Techniques 

"Internal Gonemo techniques are to be 
effective and efficient in accomplishing their internal 
control objectives." (ref.3:p.7) The final general standard 
requires that the techniques of control are effective and 
efficient. Internal control techniques are the mechanisms by 
which control objectives are achieved. These techniques are 
policies, procedures, organizational plans and physical 
layouts. Control techniques must insure that the objective 
is met with a high degree of asSurance within cost 
limitations. All control techniques should be reviewed 
periodically and evaluated as to their effectiveness’ and 
efficiency and be modified as required. Effectiveness means 
that the techniques fulfill their intended purpose. 
Efficiency means that the techniques are designed to provide 
maximum benefit with minimum effort. For example, adding 
more personnel to the internal control process may improve 
the effectiveness of techniques but not necessarily the 
erLiciency. 

2. Specific Standards of Internal Coneao 
A number of techniques are essential to providing 

the greatest assurance that the internal control objectives 


are achieved. There are six critical specific standards. 
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a. Documentation 

"Internal control systems and all transactions 
ana other significant events are to be clearly documented, 
and the documentation is to be readily available for 
examination." (ref.3:p.8) Basically, this standard requires 
that agencies document their internal control objectives, 
techniques and accountability systems and also document all 
pertinent aspects of transactions and other significant 
events of an agency. This documentation can be ina variety 
of forms, including policy manualS,management directives or 
Flowcharts of transactions. Complying with the documentation 
standard requires that the documentation of internal control 
systems and transactions and other significant events be 
purposeful and useful to managers in controlling their 
operations and also provides auditors with a guide for their 
review. 

b. Recording of Transactions and Events 

"Transactions and other significant events are 
Eo be Pprompe by recorded and properly classified." 
Peek. 3:p.9) This standard applies to the entire life 
cycle Of a transaction and includes initiation and 
authorization, all aspects of the transaction while in 
Process and its final classification in summary records. 
This standard also provides management with the information 
it needs to control operations and provides summary records 


from which reports are prepared and for internal review and 
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audits. Failure to adhere to this standard can result in a 
loss of information if transactions are not recorded or are 
misclassified. Also, if the information is untimely the 
agency's reports can be erroneous. 
c. Execution of Transactions and Events 

"Transactions and other significant events are 
to be authorized and executed only by persons acting within 
the scope of their authority.” (ref.3:p.9) The purposeme: 
this standard is to assure that only valid transactions and 
other events are entered into. Organizations must have clear 
lines of authority for certain decisions such as_ cash 
payments. Independent evidence should be maintained so that 
proper authorizations are issued and _e so that the 
transactions conform with the terms of the authorizations. 
Authorization must be clearly understood by all persons 
concerned and specific conditions of authorization must be 
Clear to ensure compliance with this standard. 


d. Separation of Duties 


"Key duties and responsibilities in 
aucnorizing, processing, recording, and reviewing 
transactions should be separated among individuals." 
(ret.s2p. 10) No one individual should control all key 
aspects of a transaction or event. The primary factor for 


deciding when to separate duties is if the performance of 
duties by one person would allow that person to commit fraud 


Or abuse the system. Duties and responsibilities should be 
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Heoton-eaueta sd eemumpDer GL individuals to ensure effective 
checks and balances exist. One major area to watch in this 
area is collusion, because collusion can reduce or destroy 
the effectiveness of this standard. Unfortunately,collusion 
is very hard to discover since it involves two or more 
mierviduals. 
e. Supervision 

"Qualified and continuous supervision is to be 
provided to ensure that internal control objectives are 
achieved." (ref.3:p.10) This requires supervisors to 


continuously monitor the work of their employees and ensure 


they receive proper training and direction. The assignment, 
review and approval of employees' work includes 
communicating the duties and responsibilities Clearly, 


periodic review of performance and approval of work at 

Critical points to ensure timely completion. This standard 
ties together internal controls and can prevent weaknesses 
Such aS collusion from occurring. Supervision is a subset of 
Operational control and is generally concerned with the day 
to day operations of the organization. Mautz and White say 
Supervision is designed to provide reasonable assurance 
that employees utilize and conserve the aAGEUVitiy' Ss 
resources and do not undertake actions detrimental to the 
accomplishment of stated objectives (ref.4:p.15).The process 
involves managers who get things done by working with 


others instead of continuously monitoring personnel actions. 
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fF. Access to and Accountability for Resources 

"Access to resources and records is to be 
limited to authorized individuals, and accountCabdllicy eee 
the custody and use of resources is to be assigned and 
maintained. Periodic comparison shall be made of the 
resources with the recorded accountability to determine 
whether the two agree. The frequency of the comparison 
Shall be a function of the vulnerability of the asst 
(ref.3:p.11) The basic concept behind this standard is to 
restrict access to resources. This will help reduce’ the 
risk of fraud, waste or abuse of assets. Some assets,(e.g., 
cash and pilferable material) are more vulnerable to fraud, 
waste or abuse than others. This is because of factors such 
as cost, portability, exchangeability, and the perceived 
risk of loss or improper use of the resources. Each ageney 
must evalnia te Nes BeSouUrGes and establish convteer 
commensurate with these factors that provide reasonable 
assurance that these resources are safeguarded. 

3. Audit Resolution Standard 
a. Prompt resolution of audie finding. 

"Managers are to promptly evaluate findings and 
recommendations reported by auditors, determine proper 
actions in response to audit findings and recommendations, 
and complete, within established timeframes, all actions 
that correct or otherwise resolve the matters brought to 


management's attention.” (ret ssp 
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The process of resolving audit findings begins’ when 
the audit results are presented to management and is 
completed when actions have been taken to correct the 
identifed deficiencies, produce improvements or demonstrate 
the audit findings are either invalid or do not warrant 


management action. 


BG CONCLUSION 

The implementation of the Federal Managers' Financial 
imeecotriie ACE, me OMB Circular A-i123 andythe GAO Standards for 
Internal Controls in the Federal Government has been 
progressing, although not as quickly as was expected. 
However,the requirement for implementation and evaluation of 
Ehese controls is real. 

The standards for internal control must be understood 
by the personnel implementing and evaluating these systems. 
Nevertheless, these are broad guidelines which management 
must tailor to meet its own specific organization. 

Based on our discussion of the standards of internal 
in the Federal Government, we will next discuss the system 
of internal control evaluation the Navy is using Go 
implement the Federal Managers’ Financial Integrity Act of 


ioe and to comply with the requirements of the Act. 
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IITI.OVERVIEW OF THE INTERNAL CONTROL EVALUATION SYSTEM 


A. INTRODUCTION 

Once Congress passed the Federal Managers' Financial 
Integrity Act of 1982,it became a requirement for each 
agency to conduct evaluations of their systems of internal 
control. OMB developed and revised Circular A-123 to issue 
guidelines for the evaluation of internal controls. These 
guidelines have been expanded to include not only accounting 


controls but also administrative controls. 


ACCount ing controls safeguard assets and assure 
reliability of the financial records. Accounting Comumeue 
in one form or another are also employed in other 


nonfinancial functions (e.g., supply, personnel and property 
management). Administrative controls provide the 
organizational structure, policies and procedures through 
which goals and missions are achieved and coordination is 
maintained. They are designed to assure adherence to 
applicable regulations and policies. The Department of 
Defense (DOD) and the Department of the Navy have used the 
OMB guidance in developing the system currently used to 
evaluate internal controls in their agencies. 

The entire internal control evaluation process musta. 
understood before one can do evaluations and analyze the 


results. An eight element internal management’ control 
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program must be developed by each DOD component in 
peeerdance When DOD Directive 5010.38A (ref.5:p.4). The 
eight elements are: 

InMmOrcanizinggthe internal management control process 

2. Segmenting the components into assessable units 

Pmoonduicting vulnerabm@lty assessments on those units 

4. Developing plans for subsequent action 


5. Conducting internal management control reviews or 
other appropriate management actions 


6. Scheduling and taking corrective action 
fee roviding EOr quality control 
8. Preparing reports. 


This chapter will f£ocus on thiS process. 


B. ORGANIZING THE PROCESS 

One of the most critical aspects of the entire internal 
control process iS organizing the evaluation DO ea. 
Organizing the internal management control process includes 
assigning responsibilities and providing personnel for 
Blanning, Girecting, and comtrolling the program; developing 
internal reporting and tracking capabilities; maintaining 
documentation; and scheduling evaluations. This organization 
effort provides the framework that ensures that evaluation 
improvement and reporting on internal controls is conducted 


efficiently and effectively. 


oa 


l. ASSigning Respens Neue hemces 

The head of the agency is required to submit a 
statement on the status of the agency's internal) Gontrores 
However, the preparation of this statement must be delegated 
down to senior agency officials to ensure that the process 
of evaluating and reporting on internal controls is in 
accordance with promulgated guidelines. These senior 
officials are charged with the responsibility to provide the 
agency head with written assurances that the program was 
Carried out in an efficient and effective manner. 

The assignment of responsibilities should include 
one senior official to oversee the entire process. This 
senior official oversees the organizational units and these 
in turn oversee the heads of individual activities. This 
process should be organized down to the lowest level of 
responsibility that is feasible for the etficlent =operaeaeas 
of the process. 

In addition,the Inspector General, internal audit or 
internal review personnel can be of great help in the 
Organizing process to reduce or prevent duplication of 


Strtor se 


Ze Providing Personnel for the Program 





It is essential that a sufficient level of staff 
Support and resources be committed to the process. for 
planning, directing, and controlling. It 1s high!) se 


that most of these personnel will have little or no 


28 


Se pemuence es meevyalUating Internal controls. Therefore, it is 
Peseta tia, limEhem process iS to be successful, some 
Specific measures are considered such as orientation 
and training, supervision, technical assistance, monitoring 
to assure the reviews are performed adequately, and 
individual appraisal of their performance. Personnel 
involved in the process should be advised that this will be 


a factor in their overall performance evaluation. 


ae Developing Internal Reporting and Tracking 
Capabilities 


An internal reporting and tracking system must be 
established to ensure that the evaluation process is 
performed in a timely manner. The system at a minimum 
should include reporting and tracking of vulnerability 
assessments, internal management control reviews and, most 
importantly, corrective actions to be taken on a timely 
basis. The system should also be able to provide information 
to support preparation of the agency's required annual 
statement and the gathering of information on actions 
necessary to improve internal controls. 

4. Maintaining Documentation 

Adequate documentation must be maintained. All 
documentation connected with the process of conducting 
vulnerability assessments, internal management control 
reviews and follow-up action should be kept to provide a 


record on what was done and who performed the duties. This 


Ze 


information will also be valuable for réviewing the valivqmes 
OF conclusions'7 reached, evaluation of performance of 
individuals performing the reviews and an audit trail for 
future assessments. 
5. Scheduling Evaluations 

The scheduling of evaluations is driven by the 
Circular A-123 requirements. The process should be scheduled 
to insure that all reviews are completed in time to support 
the preparation of the agency's annual statement. In 
completing the requirement, items such as the cyclical 
nature of operations, availability of personnel and resource 


availability should be taken into account. 


Cc. SEGMENTING THE AGENCY 

DOD guidance requires that inventories of assessable 
units shall be established by segmenting the component into 
organizational, funeeEtona |, programmatic, or other 
appropriate subdivisions suitable for evaluating systems of 
internal management controls, and identifying program and 
administrative activities of appropriate nature and size _ to 
facilitate a meaningful assessment. The resulting listing of 
assessable units shall be reviewed annually for changes. 

Ea developing the listing of assessable units, 
reference should be made to sources of information such as 
organization charts, procedure manuals, the agency's budget, 


and program management information systems. 
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Two important fEactors Should be considered when 
segmenting the agency. First, the segmentation should 
include the lowest level of responsibility feasible. Second, 
segmentation of the agency must provide for the systematic 


evaltiation and reporting of internal control systems. 


D. CONDUCTING VULNERABILITY ASSESSMENTS 

A vulnerability assessment is a review o£ the 
susceptibility of all the programs listed in the 
segmentation process to the occurrence of waste, loss, 
unauthorized use or misappropriation. The vulnerability 
assessments do not identify or evaluate the effectiveness 


Of internal controls; they only establish the potential for 


foss. 

Each agency conducts its own vulnerability 
assessments. They are performed by all levels of management 
Pee luding the lowest possible responsible level as 


determined by the segmentation process. 

The vulnerability assessment consists On three 
steps: (1) analysis of the general control environment, (2) 
analysis of inherent risk, and (3) preliminary evaluation of 
safeguards. Completion of these three steps is then 
Summarized, allowing the assessor to make an overall 
assessment of the units. The three steps of a vulnerability 


assessment will be covered below. 


gob 


lee, Analysis of the General Control Enw@iteonmene 


The environment of an activity has a major influence 
on the vulnerability of a program. There are several factors 
which influence the environment, including: 

- Management Attitude- Management recognition of the 
importance of and commitment to the establvetiieas 


and maintenance of a strong system of internal control 
as communicated to employees through actions and words. 


- Organizational Structure. The identiticat vonmoa: 
organizational units to perform the necessary functions 
and the establishment of appropriate reporting 


relationships. 


- Personnel- The competence and integrity of the 
organization's personnel. 


- Delegation and Commun ica biome on: Authority and 
Responsibility- Appropriate delegation or limitation O£ 
authority in a manner that’ provides assurance that 
responsibilities are effectively discharged. 





- Policies and Procedures-The deEinieron aoe ime meones 
and dissemination of information to all employees as 
to how the organization is intended to perform in 
YVAE1OUS Sileuakions: 


- Budgeting and Reporting Practices seine Specificat lam 
and communication of organizational goals and the 
extent of their accomplishment. 

- Organizational Checks and Balances- The establishment 
Gat an appropriate level of financial and other 
management controls and internal auditing. 

- Automated Data Processing (ADP) Consideration- When 
utilized, an awareness of the strengths and exposures 
inherent ina system that uses ADP and the existence of 
appropriate controls. 

The analysis of the general control environment 
should be performed throughout the agency. It is the first 


step in the vulnerability assessment process. The analysis 


can be performed either as a whole or individually for each 
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component. It should be performed by determining whether or 
NOE CMGliaraeteris&tics Of a strong control environment 
exists by reviewing policies and procedures, interviewing 
appropriate management personnel, observing daily practices 
Baad by) gaining a familiarity with the operations. 
2. Analysis of Inherent Risk 
The second step in the vulnerability assessment 

process is to perform an analysis of the inherent potential 
risk for waste, loss, unauthorized use or misappropriation 
due to the nature of the activity. This assessment is 
performed to determine those programs with higher risk as 
those programs generally require more control. Some factors 
to be considered in performing this analysis are: 

- Purpose and characteristics of the program 

- Budget level allocated to the program 

- Impact of the program outside the agency 

- Age and expected life of the program 

- The degree of centralization of the program 

- Special concerns of the program 

- Prior reviews of the program 

- Management responsiveness within the program 

3. Preliminary Evaluation of Safeguards 
The third step in the vulnerability assessment 

process is the making of a preliminary evaluation by the 
reviewer on the existence and adequacy of internal controls 


Over the programs. An important consideration is whether 
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adequate controls are in place to minimize or prevent 
waste, loss unauthorized use,or misappropriation. This is 
not an in-depth review of internal controls, but an 
assessmenmt by the reviewer of the existence and functioning 


Oe current contrmeme. 





4. Summarizing the Results of the Vulnerability 
Assessments 
After completing the three steps of the 


vulnerability assessment process,the reviewer can summarize 
the results and make an overall assessment of the adherence 


of the program's internal control system to the prescribed 


standards and the vulnerability of the program Ge 
Waste, loss, unauthorized use, or miSappropriation. This 
information allows management to develop ae plan for 


conducting the internal control review process. 


E. CONDUCTING INTERNAL MANAGEMENT CONTROL REVIEWS 

Once the vulnerability assessments have been completed 
and summarized, plans and schedules for internal management 
control reviews or other actions shall be developed based on 
a ranking of the assessable units' vulnerability. 

An internal management control review is a detailed 
examination of an assessable unit to ensure internal 
controls exist, are in place, documented and functioning as 
intended. These in-depth reviews should identify weak, non- 
existent Or excessive controls.) and init lace actions 


necessary to correct them. 
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Internal management control reviews shall include the 
following six steps: 
1. Identification of event cycles 


2. Analysis of the general control environment 


is 


Documentation of the event cycles 

4. Evaluation of internal controls within the event cycles 

Baeelesting the internal controls 

6. Reporting the results. 

1. Identification of Event Cycles 
The first step of this process breaks down each 

program into their respective event cycles. An event cycle 
is basically a series of related steps within a program that 
are held together by significant beginning and end points. 
Generally accepted auditing standards usually segment event 
cycles into the following categories: sales and collections, 
acquisition and payment, payroll and personnel, inventory 
and warehousing and capital acquisition and repayment. Most 
programs have many event cycles and each event cycle 
represents an area that should be examined for internal 
controls. An example of an event cycle for administration 
would be a payroll department. The cycle begins with proper 
authorization of employment, pay computed using only valid 
time cards, proper withholding of taxes, segregation of 
duties foie personnel processing checks and those 
distributing them. Another example of an event cycle within 


an activity publishing directives would include gathering 
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information, writing a arate, transcribing editing 
EGlrcilating  Eor Wemmenes. revising, transcribing in final 
Format, publishing, distributing and updating. ~Once alleen 
events for a particular program are identified, a 
determination is made as to their vulnerability to risk. The 
source of intormatCion for this 1S the resuleaeeopen. 
Vulnerability assessments. The judgment of the person 
performing the review can also be used. [It 1S important to 
maintain all documentation relating to this process to 
provide future reviewers with an audit trail. 
2. Review of the General Control Environment 


The environment in which the event cycle operates 


has a major impact on the effectiveness of internal 
controls. An important part of the internal management 
control review iS an evaluation of the general control 


environment listed earlier. Analysis of the general conema 
environment performed for the vulnerability assessment can 
be used for this process but should be updated or modified 
as required. 


3. Documentation of the Event Cycles 





The reviewer of an event cycle must thoroughly 
understand each part of the event cycle. This understanding 
is accomplished through completely documenting the cycle. 
This is particularly important when the person preparing the 
documentation is not the reviewer. The documentation can be 


in the form of a narrative description or a flowchart with a 
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narrative description. Documenting the event cycle is 
accomplished through reviewing past documentation and 
interviewing personnel involved in the cycle. The 
documentation should include such things as_ procedures 
followed, interviewing personnel performing the procedures 
and examining the forms and records developed and 
maintained. Additionally, the reviewer should examine the 
documentation with personnel involved in the cycle to ensure 
it accurately reflects the cycle correctly. Also ae small 
number of transactions may be traced through the cycle. Both 
of these procedures will ensure the documentation and the 
understanding of the event cycle are accurate. 
4. Evaluation of Internal Management Controls 

The fourth step in the internal management control 
process is to evaluate the event cycle by using the 
documentation. This evaluation should help the reviewer 
decide if the internal control system is sufficient to 
provide reasonable assurance against waste, loss, 
unauthorized use or misappropriation. This evaluation can 
also determine whether the internal control system meets the 
requirements of the Federal Managers! Financial Integrity 
Act and OMB Circular A-123. 

The manner in which this is done is to first 
ascertain the control objectives for the event cycle. If the 
control objectives are achieved, the potential for the 


occurrence of waste, Less, unauthorized use Or 


a 


misappropriation is significantly decreased. Next, the 
control objectives for an event cycle should be written. 
This documentation should be reviewed to determine whether 
the list of objectives for each cycle is complete” Togive rs 
and relevant to the event cycle. If the control objectives 
are not adequately documented, such documentation should 
be developed and maintained as part of the overall 
documentation of internal controls. Third, the relatwoenewme 
between this, the prior task, and the inherent risks in an 
event cycle cannot be overemphasized. Control objectives 
are established because a risk of loss exists; internal 
management control techniques are implemented to prevent the 
Specific loss fReenmoceumaina: 

Another important area during this step is to 
identify whether there are any internal control techniques 
that are excessive, thereby creating Inefficiencie[ =a 
unnecessary costs. 

The final results of this process should identify 
those internal controls which require testing,the absence of 
controls that should be corrected, control objectives age 
which control techniques are not adequate and system 
corrections that must be made and control techniques’ that 
are unnecessary and can be eliminated. 

5. Testing of Internal Controls 
This is the final step in the review process and is 


used to evaluate if the controls are functioning as 
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Peano steO ls “similar to an auditor's compliance 
test. It may be done by selecting a sample of transactions 
and be viewi neg eee ne Me ceumentCatvome= fOr those Cransaetions 
to determine compliance with the related internal control. 
In addition, observing ENeGwmeCOREEolS “Lunctioning and 
interviewing personnel involved can be extremely useful. 
he control techniques are not Eunctioning properly, the 
reviewer should evaluate if there iS a compensating 


control. The reviewer should note any other techniques which 


might also compensate for the control in question. The 
review should provide documentation for any eontr ol 
weaknesses’ that were uncovered and possible corrective 


actions for the weaknesses. 


6- Reporting the Results of Internal Management Control 


Reviews 

After completing the internal management Olena 
reviews, the results are Summarized and reported on. Two 
types of reports are prepared. The first report provides 
management Jimena =P rOCramesrnformation “concerning the 
internal control weaknesses within the system and possible 
corrections. The first report includes material weaknesses 


in internal accounting and administrative controls and a 
schedule for their correction. Also, material weaknesses 
identified and corrected during the year are included in the 
first report as accomplishments. The first report is 


basically an internal document to be used by the individual 
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command EO correct any identified weaknesses. Any 


recommendations to improve the efficiency and effectiveness 


o£ the program should be included. The second reper. 
contains a listing, ident liven material weaknesses _ in 
internal accounting and administrative coOnemet Ole 


Significance to the President and the Congress, and gives 
the agency head the required information necessary to 
Support the agency head's statement. The second report must 
be made available to the public unless there is an area of 


the report that is judged to be classified. 


F. SCHEDULING AND TAKING CORRECTIVE ACTIONS 

DOD Directive 5010.38A requires that a formal follow-up 
system be established to record and track internals 
management control deficiencies from any source, schedule 
corrective actions with completion dates, and provide 
assistance for the development of plans eer implementation 
of the corrections. The recommended corrective actions of 
the internal control reviews should be reviewed for possible 
implementation on a timely basis by the functional area 
managers. Although no specific penalties are levied for not 
taking corrective actions, the administrative controls of an 
activity, if properly functioning, generally have an effect 
on employee awareness of individual responsibility and 
provide some sort of assurance that the failure to perform 
assigned procedures will result in appropriate disciplinary 
aecbi1 on. 
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G. QUALITY CONTROL 
OPNAVINST 5200.25A (ref.6:p.4) requires that quality 
control shall be exercised at all levels o£ command to 
ensure that the objectives of this program are achieved. 
Seeeutically, Navy activitiessare required to: 
ie ensure internal Control training is provided 


2. Vulnerability assessments and management’ control 
reviews are performed adequately 


3. Required reports are prepared accurately and 
submitted on time 


4. Establish a formal follow-up system for monitoring 
actions to Significant and/or systemic weaknesses 


5. Establish a system otf testing corrective actions to 
Significant and/or systemic weaknesses. 

Eee CONCLUSION 

The process of evaluating internal control systems has 
been explained in this chapter. Personnel who have received 
training in internal management control reviews should be 
able to implement this system. However, the Navy has not 
been completely successful in implementing this process. The 
implementation problems encountered by the Navy and the 
solutions the Navy has come up with to solve these problems 


will be covered in the next chapters. 
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IV. INTERNAL CONTROL PROGRAM IN THE DEPARTMENT OF THE NAVY 


A. HISTORY OF THE NAVY'S INTERNAL CONTROL PROGRAM 

Once the OMB Circular A-123 and DOD guidelines were 
issued, it was up to the DON to implement an internal 
control program of their own to satisfy the requirements of 
the FMFIA. 

The Navy's Ins internal control instruceone 


SECNAVINST 5200.35, Internal Control in the Departmencuuam 





the Navy, was issued on 29 July 1983. This instruc e fom 





incorporated the original versions of Circular A-123 and DOD 
guidance, as well as the FMFIA within DON. The instruction 
also established the Navy'S own program to develop, 
maintain, review and improve internal control systems to 
ensure resources are efficiently and effectively managed. 
In addition, procedures for vulnerability assessments and 
management control reviews were provided. 

The Lm era respenms ub1 lity for implementing the 
program was assigned to the Office of the Assistant 
Secretary of the Navy for Financial Management (ASN (FM)). 
One problem with this first instruction was that there was 
no central focal point for the Chief of Naval Operations’ 
(CNO) office to coordinate subordinate commands inputs. This 
led to some confusion by Naval activities on exactly how to 


implement the program at the local level because of no 
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jecailecdmeguidance §~from the CNO level. Infact, 1t was not 
ieealmosStesewo years later im 1985, at the insistence of 
the ASN(FM), that the CNO established an office and assigned 
responsibility for the Navy's internal control program. The 
role of the CNO's office is explained below. 

The SECNAVINST was updated and reissued on 17 May 1985. 
This revision provided updated fundamental policy guidance 
and the basic management philosophy of the DON Internal 
Gonarol Program. 

The CNO and the ASN (FM) have different roles with 
regard to the program. The role of the CNO's office is 
detailed in OPNAVINST 5200.25A (ref.6:p.5). This instruction 
Weaseissued 6 January 1986 and assigns responsibility for the 
Navy's Internal Control Program to the Assistant Vice Chief 
of Naval Operations (AVCNO) (OP-09B). The AVCNO provides the 
ASN (FM) with reports and statements required to satisfy the 
requirements of the FMFIA. The AVCNO is also responsible for 
promulgating field guidance, developing procedures, 
establishing reporting requirements, maintaining an 
assessable unit inventory, monitoring compliance, directing 
management control reviews, following up on Specific 
weaknesses assigning responsibility for correction of Navy- 
wide Specific, Significant and systemic weaknesses, 
evaluating corrective actions and coordinating all training 


Eeguirements relating to the internal control program. 
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The ASN (FM) role, under the O&fice Of tne Compreraee es 
of the Navy (NAVCOMPT), is really twofold. First, NAVCOMPT 
is responsible for the maintenance of their internal control 
policy instruction on internal control and preparation eee 
NAVCOMPT reports based on input From NAVCOMPT components on 
the status of the Navy's accounting systems internal 
controls. More importantly, NAVCOMPT is responsible =eeaa 
writing the Secretary of the Navy's annual compliance 
statement to the Secretary of Defense by consolidating all 
upper echelon DON commands such as CNO, Commandant of the 
Marine Corps and all the Secretariat level offices' annual 
compliance statements. In preparing the Secretary of the 
Navy's annual statement, NAVCOMPT extracts all material 
weaknesses that have Navy-wide application mweeacm the 


individual compliance statements they receive. 


Bs FINANCIAL ORGANIZATION STRUCTURE OF THE NAVY 

DON is a large decentralized organization that 
accomplishes its mission through the use of a chain of 
command. 

The financial management organization structure within 
DON has at its head the Assistant Secretary of the Navy tor 
Financial Management (ASN (FM)). The ASN (FM) is responsible 
for all matters related to the financial management of the 
DON including budgeting, accounting, disbursing, ftinaneines 


progress and statistical reporting and auditing. Heneegmeen. 
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ASN (FM) is the Navy's chief o£ accounting information 
systems. 

The DON has fourteen major accounting systems that meet 
the GAO definition of adequate accounting systems. 
Currently, only one of these systems is in compliance with 
the DOD Accounting Manual procedures. For example, the 
Navy's pay and disbursing system (JUMPS) was disapproved by 
GAO because there were too many errors in the system. 

The Navy recognizes that there are major deficiencies in 
its accounting systems. However,the Navy does have a plan to 
Dring all its accounting systems into substantial compliance 
with prescribed OMB and Comptroller General principles and 
standards. This plan is called the DON Strategic Financial 
Management Master Plan and details the systems, deficiencies 
and corrective actions. 

Picmmvreene ema) Chederreleneies identified in the Navy’s 
accounting systems through the management control review 
process include: 

1. Data inaccuracy and incompleteness 

2. Information does not meet uSer needs 

3. System is not under full general ledger control 

4. Systems do not have adequate internal controls 

5. Systems are inefficient, labor intensive and costly 
6. Systems do not have adequate audit trails 


meee nere slosenO UNTEOrm Chart of accounts 
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Each of these deficiencies cause Navy managers problems 
in trying to analyze their operations and deciding how to 
control, conserve, protect and use thelpm@resommen 

The FMFIA has made the Navy focus on getting their 
accounting systems in order since each accounting Novem 
must be reviewed and identified deficiencies corrected. One 


of the major reasons the Navy felt that they needed to get 


their accounming systems in order are the possible 
consequences of reporting the accounting systems as 
deficient. The possible consequences or penalties of 


reporting deficiences are the budget implications and strong 
managerial leverage that can be applied. There have been 
recent efforts to reduce the Navy's budget because of 


internal control weaknesses. 


C. EFFECT OF THE FEDERAL MANAGER'S FINANCIAL INTEGRITY ACT 

The major effect of the FMFIA on the DON was to provide 
the Navy with a significant impetus to improve management 
control and accountability by £ocusing attention on system 
problems. To this end the FMFIA has shown some success and 
the Navy has demonstrated a commitment to strengthen its 
systems. 

However, the initial Navy reaction to the FMFIA and the 
internal control program was negative. There was significant 
resistance by management when tasked to perform 
vulnerability assessments and management control reviews. A 
number of managers felt that the program was requiring them 
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to do what auditors did, in that managers were in effect 
auditing themselves. This negative attitude toward the 
program by senior line managers was and still is a major 
Seumoling block to effective implementation of the program. 

The positive aspects of the FMFIA are that first, the 
Navy has taken action to establish internal eOmeno 1 
evaluation procedures. Within the last two years, the DON 
has established and clariffiied a number of written procedures 
to guide activities in implementing a satisfactory internal 
Semerol program. 

Second, the Navy has identified and corrected material 
weaknesses. Some of these weaknesses, however, are long- 
standing problems which take time to fully correct, and the 
SOlutions are not Bae easy. 

Third, as a result of the FMFIA, the Navy has also 
iGemerried and corrected a number Of weaknesses, which 
individually are not considered to be material in lost 
money, time, etc. However, these weaknesses usually involved 
failure to comply with established policies and procedures, 
and collectively are important since failure to correct 
these weaknesses could have a material effect if all items 


are considered. 


D. RESEARCH METHODS 

The information gathering for this thesis’ included 
review of the published GAO audits and other studies,plus 
Pemeand DON instructions relevant to the internal control 
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program. In addition and more importantly, a telephone 


survey was conducted which asked the interviewees what kind 


of implementation problems they had experienced with regard 
to implementing the requirements of the FMFIA and internal 
control program at thelr organizational level. 

The interviewees consisted of personnel from the Office 
of the Navy Comptroller, the Navy Accounting and Finance 
Center, the Chief of Naval Operations, the Commander in 
Chief, U.S.Atlantic Fleet, the Commander Naval Surface 
Force, U.S. Atlantic Fleet, the Chief of Naval Education and 
Training and the Naval Audit Service. 

These commands were selected because each of them has a 
direct impact on the implementation process and most’ have 
subordinate commands to whom they provide internal control 
guidance. 

The telephone interviews were conducted ~witi “two 
individuals who had some responsibility for the internal 
control program at these activities. The procedure used 
during the interviews was to explore the history of the 
implementation process at their commands and then ask _ what 
specific implementation problems they had experienced with 
the program. Each implementation problem identified during 
the interviews was then further investigated to determine 
whether or not this problem appeared to be a Navy~-wide 


problem. The interviewees were also asked what solutions to 
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their implementation problems they had arrived at and what 


improvements they would recommend. 


E. DON INTERNAL CONTROL PROGRAM IMPLEMENTATION PROBLEMS 

The internal management control review process 
previously described would seem to be a relatively simple 
process that, if followed carefully, would produce adequate 
results and satisfy the requirements Or OME Cl Gemlar Aa ies 
and the FMFIA. Nevertheless, the Navy has experienced 
numerous implementation problems which have been the source 
of tremendous frustration for Navy managers. The first list 
of identified implementation problems are derived from 
published GAO reports (ref. 7) and a study completed by the 
President's Council on Management [mprovement (ref. 8) and 
include: 

1. Paperwork and workload burden 


2. Inadequate basis for reporting 


tJ 


lo sotielaw-up Or LraCKimng System for reporting 
corrected internal control deficiencies 


4. Accounting systems did not conform to GAO requirements 
Fach of these areas will be examined more closely. 
1. Paperwork and workload burden 
The President's Council on Management Improvement 
highlighted the paperwork and workload burden of the program 
mumeeneir October 1985 report (ref. 8:p.1). Two of the major 
Findings from this report were that : 1) a substantial time 


and paper burden was created in the FMFIA's implementation; 


493 


and 2) similar vulnerability assessment results could have 


been accomplished through a simpler process with less paper. 


In GAO's December 1385 audit SE the 
FMFIA (ref.9:p.54) GAO wrote that a common concern 
Surrounding the Act has centered on documentation of systems 
and the view that the evaluation process has become a 
burdensome paper exercise. Additionally, the House Committee 
on Government Operations expressed concern that some agency 
officials believed that implementation of the Act had 
accomplished little beyond adding to the paperwork burden. 
The Committee concluded that if managers adopt the view that 
the implementation process is merely a burdensome paper 
exercise, this attitude will hamper efforts to achieve 
substantial improvement in the management of the Federal 
Government. 

The President's Council on Management Improvement 
report found that the vulnerability assessment process was 
the most frequently criticized process. They found that 
Managers believed that this process was required to be 
performed too frequently. In addition, some managers thought 
the vulnerability assessment process could be done by 
relying on information produced from existing management 
control evaluation and reporting processes. 

Another major problem is7 staffing. Although the 
individual managers were responsible for reviewing their 


programs, there were no personnel billets identified to 
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coordinate the command programs or train the managers on the 
proper procedures. The Internal Control Program coordinators 
were generally found in the internal review organization or 
muvenmesO a Junior officer as a collateral duty, and usually 
the program coordinators had no knowledge or experience 
in the area of internal control systems. 
2. Inadequate basis for reporting 

One problem the Navy has encountered during 
implementation is an inadequate basis for reporting their 
internal control systems as being in compliance with 
prescribed standards. The Navy did not know how general 
prescribed standards would apply to their operations’ and 
their systems that were under development. The GAO audit 
(ref. 9:p.35) reported that agencies did not know if 
controls were adequate because their internal So mea |: 
programs had not yet evolved to the point that they provided 
an adequate basis to determine that the Navy's systems of 
internal controls, taken as a whole, met the requirements of 
the Act. In addition, there had been difficulty in 


identifying systemic internal control problems. 


SeeeNO follow-up or tracking system for reporting 
corrected internal control deficlencies 


Another problem area noted by the GAO was that most 
Navy activities had not established required formal tracking 
and follow-up systems to monitor and ensure that internal 


control deficiencies were promptly corrected. GAO stated 


Su 


that the Navy could progress significantly in its future 


FMFIA efEort by implementing” the required track imam 


follow-up systems throughout the Navy (refi. 7:572775) 0 oie 
major reasons given for the lack of a System werewnme 
guidance on exactly how to set up a system and the reporting 
requirements under the system. Given the quality of the 
initial implementation guidance, these reasons appear valid. 


4. Accounting systems did “Hot  Contorn to GAO 
requirements 


As stated earlier, only one of the fourteen Navy 


accounting systems is in compliance with DOD Accounting 
Manual procedures. The GAO audit on the Navy's 
implementation progress (ref. 7:p.6 ) stated that the Navy 


did not evaluate and test in operation any of their 
accounting systems, did not adequately coordinate internal 
control reviews with accounting system evaluations, and had 
not established an adequate system to track accounting 


system deficiencies. 


BP. “RESULTS: OF DNGERVIEWS 

The specific implementation problems listed below are 
derived from the results of the interviews with the commands 
listed above, and represent the interpretations Or 
perceptions of the interviewees on the effect of the 
implementation problems on the overall effectiveness of the 
internal control process. The major implementation problems 


identified in the interviews include: 


De 


1. Decentralization of the Navy 
2. Manager's resistance to participate 
3. Lack of procedural guidance 
4. Definition of an assessable unit 
5. No standard inventory of assessable units 
6. Vulnerability assessments less than required 
7. Lack of manager training 
8. Paperwork burden 
Each of these areas will now be examined. 
l. Decentralization of the Navy 
The Federal Managers! Financial Integrity Act 
process is, in general, a very cumbersome process. This 1s 
particularly a major problem for large decentralized 
Organizations such as the Navy. The paperwork aspects of the 
program are compounded by the need to promulgate the program 
fowgeeecnrough he Navy chain of command to the lowest 
managerial level. The lowest managerial level is’ then 
required to complete the required management control reviews 
in a short time frame to satisfy the reporting requirements 
up the chain of command. This layering effect can sometimes 
involve five or more levels, which can slow the overall 
process and make the manager on the bottom of the chain of 
Command sometimes perform his work in a crisis mode. 
2. Manager's resistance to participate 
WIC BENE MErOdUueT One OLS anys new system — to an 


Organization there will always be some internal resistance 
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to change that is normal human reaction. The Navy was no 
exception when it tried to implement their internal control 
program. Each interview conducted referred to the proplemman 
Manager resistance to participate in the program. There were 
several reasons given for this problem. First and ftonremoaus 
the managers believed that by reporting and documenting 
their internal control weaknesses, they were in effect 
putting themselves "on report". Managers thought that ' the 
program was making them into auditors. Secondly, managers 
believed the enormous time and effort imposed in completing 
the process was not well spent and could be used on more 
productive work. Thirdly, most line managers viewed this as 
a "staff" problem and, therefore, felt that they did not 
need to participate because they believed that internal 
controls only applied to accounting and financial controls 
and not administrative controls. Finally, it the conmanaem 
internal control program coordinator was successful in 
getting the organization's managers to participate, the 
sketchy or nonexistant guidance and training from the 
headquarters level caused a lot of managers to call _ the 


program a failure before it had a chance to be implemented. 


3. Lack of procedural guidance 





A major problem for the Navy was that procedural 
guidance on implementing certain areas of the FMFIA was 
inconsistent and overlapping. Some interviewees’ believed 


that the entire process on how the Navy wanted to implement 
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the program was not completely thought out prior to issuance 
Sreene tirst SMCNAVSinmstruction. DPimaddition, the Navy had 
not completely resolved who was going to be involved in the 
reporting cycle, how to perform vulnerability assessments 
and internal management control reviews, and realistic 
training programs for managers were not ready. This led to 
major confusion among all Navy commands because no one 
really understood the entire process. Initial guidance was 
Simply a distribution of the OMB guidelines and GAO 
standards. 
gee Definition Of an assessabte unit 

The major problem addressed in the interviewS was 
that there was not a consistent definition of what an 
assessable unit was and how detailed the assessable unit had 
memeeoe. this problem tiles back into the problem of poor 


guidance. Some activities segmented thelr organizations into 


assessable units based on their organization charts (e.g., 


Sop Ly, Operations, Administration, etc.) while some 
segmented these into smaller units (e.g., Supply was 
segmented into purchasing, reGeLVing, Shipping and 


Sesoursing). 


5. No standard inventory of assessable units 
This is a follow-on problem from the above 


discussion. The point here is that because the Navy had no 
standard inventory of assessable units, it had a problem 


directing which areas Navy commands should review on a 


Do 


Systemic basis, because some commands had not segmented 
their commands in the same way as other commands. 


a. Vulnerability assessments less than required 


The GAO audit noted that agencies have devoted 
considerable resources to making vulnerability assessments, 
and the vulnerability of thousands of operations have been 
assessed. Nevertheless, these efforts have not resulted in 
reliable and useful information to managers. 

In the interview with the Naval Audit Service 
(rei. Lu, the problem of lack of good vulnerability 
assessments at the commands that the Naval Audit Service 
had reviewed was discussed. A major problem in this area 
was that managers had a preconceived judgment over what the 
vulnerability of a program should be. This judgment was used 
instead of the process discussed earlier to identify the 
GONGLO ls already in place that could reduce the 
VUNMe rab i 1 ty Ot that area. As discussed before, 
vulnerability assessments are to be a preliminary analysis 
by the manager on where internal control strengths and 
weaknesses may exist in their programs and on the 


susceptibility of their programs to fraud, waste or abuse. 


7. Lack of manager training 





All interviewees agreed on this point. I£ the entire 
internal control process is to work and the requirements of 
the FMFIA are to be met, then it is vital that all managers 


receive Coon Line in the internal Cconerel Process. 
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Unfortunately, there was a poor definition of what training 
was required and, therefore, the quality of training was 
Misatiictaetory. Instructing and training “Managers must be 
performed to provide them with a better understanding of 
what was required of them. The consensus of opinion was that 
if all the managers were trained in the process, then the 
reviews and reports produced would be of higher quality and 
the Navy would have a better basis for reporting. 
8. Paperwork burden 

Most interviewees had some comment on the paperwork 
burden of the program as it related to manager resistance to 
the program. The problem pointed out in the interviews was 
that their managers had a firm belief that the entire 
internal management control process wasS requiring them to 
Spend already scarce resources documenting a lot of 


Mmeormation Chat they did not feel was particularly useful 


to them. Most managers felt that documenting their systems 
should produce information that could assist them in 
developing corrective actions and planning future work. The 


interviewees noted that this type of comment from managers 
Was common and generally came from frustrated managers who 


had resisted the program from the outset. 


cee CONCLUSION 
The Navy is well aware of all of the problems mentioned 


above. Most of the problems identified during the 


al. 


interviews and studies result from the fact tCnate" thew Nava 


internal control program has not yet fully evolved 


effective program. 

Some of the major findings 1nélvuded hae 
were the manager's resistance to participate 
program, the paperwork and workload burden, lack 
procedural guidance, and no follow-up system for 
control deficiencies. The Navy recognizes that 
improvements are still required to achieve a 
internal control program. 


The next chapter will describe some of the 


solutions to the identified implementation problems. 
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Vemenv: o SOLUTIONS TO IMPLEMENTATION PROBLEMA 


A. INTRODUCTION 

The GAO audits of the Navy's implementation of the FMFIA 
have commented on the Navy's implementation progress. The 
GAO noted that the "Navy had made progress in developing and 
implementing its internal control evaluation program and in 
reviewing its accounting systems for conformance with the 
Comptroller General's requirements" (ref. Wer. 2). in 
Seagition, "the Navy increased itsS organizational and 
functional coverage; conducted more assessments of the risks 
of fraud, waste, and abuse; completed an inventory of its 
accounting systems; and evaluated two major accounting 
systems and two subsystems" (ref. 7ip.2). 

The following are areas in which the Navy has made 
progress in correcting implementation problems. The 
solutions described below have been gathered from the 
interviews with major Navy commands. 

1. Updating internal control program guidance 


2. Using other sources of information to substitute 
for Internal Control Reviews 


3. Integrating audit plans into the Management Control 
review process 


A, Improving manager training 


5. Writing an Internal Control Review plan based on 
vulnerability assessments 


6. Internal Control Information System 
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A detailed description of each of these areas is 


presented below. 


B. NAVY'S ACTIONS TO SOLVE IMPLEMENTATION PROBLEMS 
1. Improving Internal Contre Culdane- 

NAVCOMPT and CNO recognized that several 
improvements were needed to achieve a quality program and 
emphasized consistent, good quality management control 
reviews, particularly documenting the control process’) and 
testing control techniques. 

NAVCOMPT and CNO established and clarified a number 
of written procedures to guide commands and activities in 
implementing a satisfactory internal control program. Some 
OL these changes include revising the vulnerability 
assessment process froma 2 toa 5 year cycle and providing 
more direction on specific areas to review. 


oe Using Other Sources of Intormacvonme eo Substitute 


ranma 


for Internal Control Reviews 

A substantial portion of management's resistance to 
the program came from managers who believed that’ the 
management control review process’ was duplicating Vee 
efforts of inspection and audit teams. The internal control 
program process required that the manager review his areas 
of responsibility to identify weaknesses and document’ the 
entire. | process. At the same time, the same manager was 


being audited or inspected in the identical area. Most 
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managers felt that this was a tremendous duplication of 
effort and laid the blame on the management control process. 

Recognizing the problem, the new OPNAVINST allows 
Navy activities to use other management control activities 
such as management studies, audit reports, inspections and 
reviews to asSess controls and substitute these for internal 
management control reviews. This solution was implemented 
because most agencies believe that audit reports, management 
studies and command inspections are an integral part of an 


effective management control system. 


Bes Integrating audit plans into the management control 
review process 


The Naval Audit Service has a number of functional 
area audit plans that are used by auditors when auditing 
Naval activities. These functional area audit plans serve as 
general guidelines for the auditors to check for compliance 
with directives and procedures. The audit plans do not 
include every possible area that can be reviewed in the 
functional area, but are the minimum effort required by the 
auditor. The reason for this is because the Audit Service 
wants their auditors to have some degree of flexibility when 
reviewing a particular area to investigate additional areas. 

The Navy is attempting to integrate these audit 
plans into the management control review process. This will 
allow activity managers to use these audit plans to aid them 


in performing their internal management control reviews. 
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The Navy hopes that each activity will use these 
audit plans as a baseline to possibly develop checklists of 
their own that can be tailored to specific management 
control problem areas. However, there are pros and cons to 
using this approach. Checklists are a management tool that 
can be used effectively, but they can also be misused. 
Checklists can be effective in ensuring that important 
review areas are not forgotten. They can serve as a reminder 
to managers that they need to ensure adequate review is 
given in each particular area. However, usually checklists 
are not all inclusive. Managers have a tendency to review 
only those areas that are included on the checklist, thereby 
potentially missing areas that need closer management 
review. What the checklist does provide is a point of 
reference; but the checklist does have the potential for 
misuse if the manager relies solely on the checklist to 
complete his management control reviews. 

4. Improving Manager Training 

Lack of or no training for the manager was a serious 
problem the Navy needed to solve if the program was to be 
successful. Two areas were developed by the Navy as 
Soluclvons to the problem. DOD disseminated a self- 
instructional course on conducting internal control reviews. 
The Navy believes that when this course is combined with 
better headquarters guidance and quality assurance 


techniques at the local level, it will achieve the desired 
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improvements because proper training will afford managers 
the knowledge required to perform the required tasks within 
Enew prodqram “and Nepetulty “achteve better results. Some 
interviewees, however, found the self-instructional course 
to be too general to be of any use. 

Probably one of the best improvements to the program 
is the internal control program indoctrination that 
prospective Commanding Officers (PCO) and prospective 
Executive Officers (PXO) receive.The goal is to indoctrinate 
as many PCOs and PXOs as possible on the internal control 
Beecgram Orior to reporting to their new assignments. By 
making these officers aware of the internal control program 
and the importance of establishing and maintaining an 
effective internal control progran, it is hoped that 
internal controls can become a mindset among line managers. 
Most interviewees believed that this improvement of 
increasing the consciousness of Navy managers to internal 
controls will go much further in the Navy's effective 
implementation of the progran, because if Commanding 
Officers and Executive Officers take an active interest in 
me program, it can be successful. 


>. Writing an Internal Control Review Plan Based on 
Vulnerability Assessments 


One problem area previously mentioned was that the 
internal control reviews were sometimes duplicating the 


efforts of recently completed audits, inspections and other 
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reviews. To solve this duplication of GEEOrtC problem, een 
CNO, in conjunction with the Naval Audit Service, is writing 
a five year internal control review plan based on the 
results of the Navy's vulnerability assessments. This five 
year plan will be meshed with the Naval Audit Service's five 
year audit plan to determine which areas will be reviewed by 
the Naval Audit Service, and will satisfy the requirement of 
completing a management control review. The resulting audit 
plan and internal control review plan will be reviewed by 


the AVCNO and the Naval Audit Service, and will be 


DPElLOri1 tized based upon the results Ot: the Navy's 
vulnerability assessments. Joint approval of these plans 
will be accomplished by both activities. This is a change 


Chat is allowed under the recent revision to OMB Circular 
A-123. By merging the internal control plan and audit plan, 
Che Navy hopes there will be a reduction taythesauai coe 
of effort. In addition, if this meshing is successtul; Yume 
Navy believes that the program implementation will be 
improved due to increased functional area coverage, a 
Greater number of assessments can be conducted and, best of 
all, there will be improved identification and correction of 
internal control weaknesses. 
6. Internal Control Information System 

The Navy has developed an innovative alternative to 

the traditional approach to accounting systems evaluations. 


The traditional approach is weak ina number of = significant 
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Saeco eet Tce the cCeacthelOnal approach has often failed to 
encempass the entire system looking only at individual 
segments of systems. Second, qualitative measurements of 
Peet lew ehreats stacing a system and the resulting risk 
reductions achieved by individual internal controls have not 
been obtained. Lastly, the traditional approach has not 
elmsewed @rhor cost-benefit analysis of the merit of specific 
moeernal controls. 

As a specific action to overcome these shortcomings, 
NAVCOMPT has developed the Internal Control Information 
Syemem (1CIS) (ref. ll). The ICIS is a Subset of NAVCOMPT's 
Consolidated Systems Evaluation Program (CSE). CSE 1s a 
comprehensive approach to accounting systems reviews to 
determine the adequacy of an accounting system's conformance 
mem requiations, data processing soundness, Lumet ional 
soundness, and internal control soundness. 

ICIS is a computer/software supported approach to 
internal control review and improvement which addresses each 
OL the Shortcomings of the traditional approach eo 
accounting systems evaluations. The ICIS reviews entire 
systems instead of individual segments and develops) and 
addresses specific threats, associated dollar risks,and risk 
reduction achieved by individual controls. 

Jot ia Oortea Check }iSt approach to internal control 
evaluation. It iS an approach which evaluates the threat and 


potential dollar impact in each area. Expected threat 


occurrence rates are determined and all controls and their 
risk reduction are computed. This procedure produces a 
11s Citas which shows initial exposure, risk reducurenm 
achieved by specific controls and the remaining risk after 
all controls are considered. This allows the manager to look 
at each control with regard to its” cost-beneitre. In 
addition, the ICIS allows managers to use. sensitivity 
analysis to explore the impact of adding, deleting or 
modiiving internal co@erols:. 

Finally, the ICIS appears to be an efficienmm 
innovative approach to accounting systems reviews. It is 
certainly a step in the right direction,and it is hoped that 
this system will prove to be effective in improving reviews 


of internal controls in the Navy's accounting systems. 


G. OTHER IMPROVEMENTS 

Two other improvements deserve mention here. The 
President's Council on Management Improvement's report 
identified the following two areas of potential improvement 
to the implementation process. The Council looked across 
different government agencies to see what they were doing in 
relation to accomplishing the requirements of the FMP TASS ia 


Navy is working on the following two areas. 


1. Developing a Short Form for Management | Coneaem 
Reviews 








The Department of the Army has developed a checklist 


approach to the internal management control review. The Army 
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moved in this direction because of the extensive amount of 


 Rim—enuedtistnonscem(anot Unlike Ehe Navy) that specify how 


ee tua (lS should be performed so more standardization 
was needed. Phas was accomplished by adjusting 
responsibility [ore wNcerhiakee@entrols around fEunctional 


managers and by moving to aeestandard checklist. 

The checklists include identification of the task 
under review, the associated risk, control objectives, and 
eemerol stechnmiques. The checklists are designed to aid the 
operating managers in determining if internal controls are 
Operating properly within their area of responsibility. 
Operating managers use the checklists to test internal 
controls and provide feedback and suggestions to functional 
managers. 

One interviewee stated that the Navy has done some 
P@eriminary Work in this area, but development of the Navy 
checklists has been slow because of the nature of the Navy's 


internal control reviews are so diverse. Designing a concise 


checklist has been difficult. Some commands were trying EO 
develop ere alt Gneeckiists tailored to their Speei1 fic 
commands. Further investigation by the Navy into developing 
management control review checklistS appears warranted, 


Since 1t can be shown that when correctly used _ these 
emeex!ists can reduce the paperwork burden previously 


discussed. 
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2. Using a New Vulnerability Assessment Form 
Another area noted by the President's Council was a 


vulnerability assessment short form adopted by the Federal 
Highway Administration. The Navy has modified this form for 
use within the DON. This form provides the manager with a 
concise one page checklist designed to provide a review of 
the general control environment, analysis of inherent risk 
and a preliminary assessment OF safeguards. Some 
interviewees believe that the implementation of this new 
form will be very useful to managers because it will allow 
managers to reduce the time and paperwork required to 


perform vulnerability assessments. 


D. SHORTCOMINGS OF THE NAVY s ACTIONS 

The Navy has made some progress in implementing the 
FMFPIA. The Navy's efforts to develop and improve its 
internal control evaluation program, falar: slow, have 
proven to be relatively successful. Nevertheless, there are 
still some shortcomings in the Navy's program. 

First, the Navy has spent an inordinate amount of time 
identifying and documenting internal control weaknesses and, 
in most cases, planning and taking corrective actions. 
However, the Navy has not routinely tested the corrective 
actions of the internal controls to verity that enese 
corrective actions are being systematically implemented and 


the controls are now operating as intended. The Navy needs 
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to ensure routine testing of corrective actions to determine 
Chiciemet rhectiveness. 


Another shortcoming of the implementation process is 


that internal control awareness in the Navy has not 
completely filtered down to all applicable management 
levels. The impression received throughout the interviews 


was that many of the subordinate commands had not fully 
implemented their own internal control programs. Le 
eompletely jimplement a totally effective internal control 
program, the Navy must ensure that internal control systems 
are implemented at all Naval activities to provide the means 
for preventing fraud, waste, and abuse. The best way to 
achieve this objective is to make internal controls a 
mindset among Navy managers. This requires that the internal 
control program evolve to be part of the management 
Organization of the Navy. 

The Navy needs to find a way to give the line managers 
more incentive to implement and maintain effective internal 
control systems. The line manager must be convinced that 
effective internal control systems are of greater benefit 
to him than weak controls. The benefits must be explained 
to him in terms that he can understand. For example, if the 
line manager can be shown that lack of a specific control 
is draining his resources and requiring him to forego 
meeting mission requirements (such as less ship underway 


Meme Or Elight hours, or not enough warfare training 
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exercises to enable his crew to become more battle 
proficient), then effective internal (GOntmouses ys cen een 
potentially be implemented and line managers will begin 
to associate good internal control systems with increased 
readiness. This effort will continue to be a major challenge 
for top Navy management, because getting this type of 
incentive across to all Navy managers is difficult due to 
the decentralized nature of the Navy"sS organi zaurene 

Another shortcoming noted is that the Navy needs to 
concentrate on the results of the program. Strengthening 
internal controls and accounting systems is the bottom line 
of the FMFIA. The Navy needs to concentrate more on the 
substance of the evaluation process and less on 
documentation and report language to achieve the overall 
objective of improving internal controls and accounting 
systems. 

Finally, the Navy's organization needs to investigate 
how it can ensure the overall effectiveness of its internal 
control program. In the private sector the approach used is 
the formal audit committee. This committee oversees’ the 
various audits to ensure the overall effectiveness of the 
audits the particular company receives. The members are 
independent of management. This is important because it 
relieves management of any pressure, perceived or otherwise, 
which may impact on the effectiveness of the particular 


audit. The Navy may investigate use of an inter-disciplinary 
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DOG, edpare irom NAVEOMET and AVCNO to integrate the various 
tiseinal Cemerol —icencepess and definitions and te develop a 
common reference point. This body's guidance would move to 
develop a standard against which other activities can judge 
the effectiveness of their internal control programs, and 
moe nelp other Naval activities improve their internal 
control systems. This oversight committee could be charged 
with overseeing the financial reporting process and_ the 
Navy's internal control system. It could also independently 
ensure that the Navy was making satisfactory progress toward 
improving systemic internal control weaknesses and further 
enhance the Navy's ability to report their accounting 


systems and internal controls in compliance with the FMFIA. 


fee CONCLUSION 

ne Navy sis working wto strengthen its internal 
Management control program. While progress has been made by 
the Navy to correct some of the implementation deficiencies 
and smooth out the rough edges, there is still a lot of work 
Chat the Navy needs to do before it has an efifective 
internal management control program and more importantly a 
system of internal controls that will meet the intent and 
tne requirements of the FMFIA. 

The last chapter provides a summary along with some 
recommendations and conclusions on what additional actions 
the Navy could possibly undertake to make further progress 
in the implementation of the Act. 
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VI. CONCLUSIONS AND RECOMMENDATIONS 


A. SUMMARY 

The purpose of this thesis was to determine whether the 
Navy has successfully implemented the Federal Managers’ 
Financial Integrity Act of 1982; to determine if the Navy 
has resolved their implementation problems, and if the Navy 
has come up with any innovative ideas to make the management 
control process more efficient and effective. 

This thesis consolidates and highlights information on 
the Navy's implementation problems and their efforts’ to 
improve their internal control problems. After the initial 
historical background Of internal COner eo. program 
development in the Federal Government, an explanation of the 
current internal control evaluation system was covered. This 
chapter was presented to give the reader an appreciation of 
the depth of information and workload required by the 
Current internal control process. 

The history of the Navy's Internal Control Program, the 
Navy's tinancial management structure and accounting systems 
weaknesses, and the implementation problems the Navy has 
experienced in implementing their internal control program 
was then developed and discussed. The information in this 
chapter was designed to show the reader the historical 


difficulties encountered by the Navy in organizing their 
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paced vom L ype Of Organizational stru@eture the Navy 
Operates under and present the implementation problems 
encountered by the Navy in detail. 

The Navy's solutions to the implementation problems’ and 
the shortcomings of those solutions were then covered in 
detail. The reader should hopefully obtain from this chapter 
Sameappreectationm of Ehe Navy’s efforts in correcting “their 
implementation problems. Additionally, it should be apparent 
to the reader how much further the Navy's program needs to 
evolve before it can be judged as being completely 
entrenched in the Navy's organization. 

The Generalization of the results of this study are 
limited, given that only a few activities were able to be 
interviewed. Nevertheless, since the activities interviewed 
were senior Navy echelon commands, the results of this study 


could be extended to other Naval activities. 


Ee CONCLUSIONS 

Based on the research conducted for this thesis, one 
conclusion reached was that the concept of internal control 
in the Navy has progressed significantly over time since the 
program's inception. It has grown from merely a means to 
@etect and prevent fraud to include the means of effectively 
performing a mission or realizing an objective. 

The FMFIA process has produced a heightened awareness of 


meemimportCance of internal controls at all management levels 


and has reiterated management's respons fom aes, Eom 
establishing and testing those controls. 

The Navy's efforts to fully implement the FMFIA are far 
from complete. Although the basic framework for an effective 
internal control program has been established within the 
Navy, the research conducted indicates furtites 
implementation must be done before the Navy'S program can 
provide an adequate basis for determining that internal 
controls, taken as a whole, comply with the objectives of 
the Act. The Navy has recognized the deficiencies in the 
implementation process and has moved to correct these system 
deficiencies. 

In my opinion, the largest obstacle the Navy needs’ to 
overcome to make implementation of internal cControgs 
successful is the line manager's resistance to participate 
in the program. This problem is) Weempouneecwye the 
decentralized nature of the Navy's organization. As_~ stated 
before, the Navy's internal control program needs to evolve 
to be part of the management organization. How is the Navy 
to achieve this evolution? My opinion is that the Navy 
needs to go back to basics and have managers assess 
themselves by looking at what they are assigned to do, 
evaluate the results against whether or not they are doing 
it, and if there is a difference between the two, then take 


the appropriate corrective actions. Giving the line manager 
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more incentive to have strong internal control systems is 
also extremely important. 

Wimertunately, thks gqimplistic solution wilt only work 
where the Navy already has good managers in place. 
ime lememeallomewor ekieective internal control programs has 
not been a major problem where good managers existed. Where 
poor managers exist, internal control programs will tend not 
jor De SUCCESSEU] seebt this is the case then increased 
scrutiny over these poor managers will be required to ensure 
the objectives of the internal control program are achieved. 

Other implementation problems’ and solutions are 
procedural in nature and the solutions will eventually make 


the Navy's internal control program more effective. 


C. RECOMMENDATIONS 

What will be the future of the Navy's internal control 
program? Although a number of Navy managers probably thought 
that this was just another bureaucratic program that would 
die away, my view is that the Navy's internal control 
program with the backing of the FMFIA is here to stay. The 
Future of a successful program, however, will depend on a 
number of factors that have been previously discussed. Since 
the program is not going away, it is in the best interest of 
the Navy to make the program work for the Navy and improve 
its internal controls and accounting systems instead of 


making the Navy work for the program. 
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The following actions are recommended: 


The Navy needs to continue to incorporate the 


internal management control process into the overall 
management process. This would result in greater 
support for the internal control process Yandewouus 
relieve duplication of reviews and tracking systems. 
The Navy should consider reducing the paperwork 
burden, and reduce staff days required to maintain the 
process by further developing checklists to help 
managers perform internal control reviews. These 
checklists should include the minimum essential 
controls needed to comply with the internal control 
Standards. These checklists would serve to reduce the 
program down to a simple, manageable level. 

The Navy needs to continue to gain the support of 
senior line managers in relation €o0 the Sintemiees 
control process through incentives in terms the line 
manager can relate to. This 1s a critical area because 


without these senior manager's support the internal 


control process will not succeed. The Navy's efftopes 
in indoctrinating PCOS and 52205 will make this much 
Gasier: 


The Navy needs to continue its efforts to implement an 
effective tracking and follow-up system. Such systems 
are essential to monitor and ensure that actions 


developed to correct internal control deticiencles ware 
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completed. The Navy needs to establish a central area 
Siem as the AVCNO Eor reporting correction status of 
weaknesses and streamline follow-up for all identified 
weaknesses. 

As a related recommendation, the Navy could establish 
an improved implementation feedback program. This, 
along with a system of lessons learned, could ensure 
that implementation problems are identified For 
evaluation and serve as a guide for managers’ to 
determine the actual status of their implementation 
pEOCeSsS. 

To fully implement an effective internal control 
program, the Navy needs to develop more effective 
manager training which supports the program and gives 
a set of guidelines for the establishment and reviews 
O£ internal controls. 

The Navy needs to continue to focus on alternative 
Ways to complete the management control review process 
which are most cost-beneficial. The Navy has moved 
closer in this direction by now allowing the use of 
augits, inspections and other reviews to serve the 
purpose of management control reviews. 

As a long range goal, the Navy should study the 
Feasibility of establishing a computer network for 
reporting requirements of the Act. Automating the 


documentation Of vulnerability assessments and 


cay 


management control reviews could go a long way toward 


implementing recommendations 4 and 5. 

The Navy needs to investigate the use of an 
oversight committee, possibly including outsiders eee 
integrate internal control concepts and detiniverew 
and to develop a common reference point. This body 
could help ensure the Navy was making satisfactory 
progress toward improving internal control weaknesses 
and enhance the Navy's ability to meet the 


requirements of the FMFIA. 
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